CVE-2024-31496: Stack buffer overflow in CLI command

Published Nov 12, 2024

Updated

A stack-based buffer overflow vulnerability [CWE-121] in FortiManager, FortiAnalyzer and FortiAnalyzer-BigData CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.

Other sources

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests.

— MITRE

Affected Software

21 affected componentsFixes available

Fortinet FortiAnalyzer>=6.2.0<7.2.6

Fortinet FortiAnalyzer>=7.4.0<7.4.3

Fortinet Fortianalyzer Big Data>=6.2.1<7.2.8

Fortinet Fortianalyzer Big Data=7.4.0

Fortinet FortiManager>=6.2.0<7.2.6

Fortinet FortiManager>=7.4.0<7.4.3

Fortinet FortiAnalyzer>=7.4.0<=7.4.2

Fortinet FortiAnalyzer>=7.2.0<=7.2.5

Fortinet FortiAnalyzer>=7.0

Fortinet FortiAnalyzer>=6.4

Fortinet FortiAnalyzer>=6.2

Fortinet FortiAnalyzer-BigData=.

Fortinet FortiAnalyzer-BigData>=7.0

Fortinet FortiAnalyzer-BigData>=6.4

Fortinet FortiAnalyzer-BigData>=6.2

Fortinet FortiManager>=7.4.0<=7.4.2

Fortinet FortiManager>=7.2.0<=7.2.5

Fortinet FortiManager>=7.0

Fortinet FortiManager>=6.4

Fortinet FortiManager>=6.2

Remediation

Information

Please upgrade to FortiAnalyzer-BigData version 7.4.1 or above Please upgrade to FortiAnalyzer-BigData version 7.2.8 or above Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiAnalyzer version 7.4.3 or above Please upgrade to FortiAnalyzer version 7.2.6 or above

Event History

Nov 12, 2024

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·06:53 PM

Data Sourced

via MITRE·06:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-31496?

CVE-2024-31496 is categorized as a critical vulnerability due to its potential for arbitrary code execution via crafted CLI requests.

How do I fix CVE-2024-31496?

To fix CVE-2024-31496, upgrade FortiManager or FortiAnalyzer to versions 7.4.3, 7.2.6, or the respective recommended versions for your software.

Which Fortinet products are affected by CVE-2024-31496?

CVE-2024-31496 affects FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData across various versions.

Can an unprivileged user exploit CVE-2024-31496?

No, an attacker must have privileged access to exploit CVE-2024-31496 and execute unauthorized commands.

What type of vulnerability is CVE-2024-31496?

CVE-2024-31496 is a stack-based buffer overflow vulnerability classified under CWE-121.